diff options
| author | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2023-02-02 01:01:11 +0300 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2023-02-10 01:18:48 +0300 |
| commit | df5703348813235874d851934e957c3723d71644 (patch) | |
| tree | aa8217ebec403131c1524a365c6ac6e70fe71302 /crypto | |
| parent | 2394186a2cefb9a45a029281a55749804dd8c556 (diff) | |
| download | linux-df5703348813235874d851934e957c3723d71644.tar.xz | |
Bluetooth: L2CAP: Fix potential user-after-free
This fixes all instances of which requires to allocate a buffer calling
alloc_skb which may release the chan lock and reacquire later which
makes it possible that the chan is disconnected in the meantime.
Fixes: a6a5568c03c4 ("Bluetooth: Lock the L2CAP channel when sending")
Reported-by: Alexander Coffin <alex.coffin@matician.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'crypto')
0 files changed, 0 insertions, 0 deletions